I believe it is the/a executing process forWin32/Vundo.BR Trojan that displays ads and is very difficult to remove (According to Windows Defender). When W.Defender. rebooted the system to complete the cleaning, it had to Kill sprt.cmd. Other files related to this Trojan are ...system32\__c00978c2.dat or similar names. There is an HKLM key ...\winlogon\notify\__c009782c2